8 files changed, 39 insertions, 9 deletions
diff --git a/config/application.rb b/config/application.rb
index 6bd47cd6c..ed5fdb7f7 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -68,12 +68,17 @@ module Mastodon
 
     config.active_job.queue_adapter = :sidekiq
 
+    #config.middleware.insert_before 0, Rack::Cors, debug: true, logger: (-> { Rails.logger }) do
     config.middleware.insert_before 0, Rack::Cors do
       allow do
         origins  '*'
         resource '/@:username',  headers: :any, methods: [:get], credentials: false
         resource '/api/*',       headers: :any, methods: [:post, :put, :delete, :get, :patch, :options], credentials: false, expose: ['Link', 'X-RateLimit-Reset', 'X-RateLimit-Limit', 'X-RateLimit-Remaining', 'X-Request-Id']
         resource '/oauth/token', headers: :any, methods: [:post], credentials: false
+        resource '/assets/*', headers: :any, methods: [:get, :head, :options]
+        resource '/stylesheets/*', headers: :any, methods: [:get, :head, :options]
+        resource '/javascripts/*', headers: :any, methods: [:get, :head, :options]
+        resource '/packs/*', headers: :any, methods: [:get, :head, :options]
       end
     end
 
diff --git a/config/environments/production.rb b/config/environments/production.rb
index f1351e378..928fd13e5 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -96,9 +96,12 @@ Rails.application.configure do
   end
 
   config.action_dispatch.default_headers = {
-    'Server'                 => 'Mastodon',
-    'X-Frame-Options'        => 'DENY',
-    'X-Content-Type-Options' => 'nosniff',
-    'X-XSS-Protection'       => '1; mode=block',
+    'Server'                  => 'Mastodon',
+    'X-Frame-Options'         => 'DENY',
+    'X-Content-Type-Options'  => 'nosniff',
+    'X-XSS-Protection'        => '1; mode=block',
+    'Content-Security-Policy' => "frame-ancestors 'none'; object-src 'none'; script-src 'self' https://dev-static.glitch.social 'unsafe-inline'; base-uri 'none';" , 
+    'Referrer-Policy'         => 'no-referrer, strict-origin-when-cross-origin',
+    'Strict-Transport-Security' => 'max-age=63072000; includeSubDomains; preload'
   }
 end
diff --git a/config/routes.rb b/config/routes.rb
index 2aa89f16d..fb2051aad 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -178,7 +178,7 @@ Rails.application.routes.draw do
         end
       end
 
-      resources :notifications, only: [:index, :show] do
+      resources :notifications, only: [:index, :show, :destroy] do
         collection do
           post :clear
           post :dismiss
diff --git a/config/settings.yml b/config/settings.yml
index d239fb6a6..d677e1f84 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -7,7 +7,7 @@
 # For more information, see docs/Running-Mastodon/Administration-guide.md
 #
 defaults: &defaults
-  site_title: Mastodon
+  site_title: 'dev.glitch.social'
   site_description: ''
   site_extended_description: ''
   site_terms: ''
diff --git a/config/webpack/generateLocalePacks.js b/config/webpack/generateLocalePacks.js
index b71cf2ade..cd3bed50c 100644
--- a/config/webpack/generateLocalePacks.js
+++ b/config/webpack/generateLocalePacks.js
@@ -34,6 +34,23 @@ locales.forEach(locale => {
   ].filter(filename => fs.existsSync(path.join(outPath, filename)))
     .map(filename => filename.replace(/..\/..\/node_modules\//, ''))[0];
 
+  let glitchInject = `
+const mergedMessages = messages;
+`;
+
+  const glitchPath = `../../app/javascript/glitch/locales/${locale}.json`;
+  if (fs.existsSync(path.join(outPath, glitchPath))) {
+    glitchInject = `
+import glitchMessages from ${JSON.stringify(glitchPath)};
+
+let mergedMessages = messages;
+Object.keys(glitchMessages).forEach(function (key) {
+   mergedMessages[key] = glitchMessages[key];
+});
+
+`;
+  }
+
   const localeContent = `//
 // locale_${locale}.js
 // automatically generated by generateLocalePacks.js
@@ -41,7 +58,8 @@ locales.forEach(locale => {
 import messages from '../../app/javascript/mastodon/locales/${locale}.json';
 import localeData from ${JSON.stringify(localeDataPath)};
 import { setLocale } from '../../app/javascript/mastodon/locales';
-setLocale({messages, localeData});
+${glitchInject}
+setLocale({messages: mergedMessages, localeData: localeData});
 `;
   fs.writeFileSync(localePath, localeContent, 'utf8');
   outPaths.push(localePath);
diff --git a/config/webpack/loaders/babel.js b/config/webpack/loaders/babel.js
index a1992a450..49b191d26 100644
--- a/config/webpack/loaders/babel.js
+++ b/config/webpack/loaders/babel.js
@@ -8,5 +8,6 @@ module.exports = {
   loader: 'babel-loader',
   options: {
     forceEnv: process.env.NODE_ENV || 'development',
+    sourceRoot: 'app/javascript',
   },
 };
diff --git a/config/webpack/loaders/sass.js b/config/webpack/loaders/sass.js
index 88d94c684..40e81b43b 100644
--- a/config/webpack/loaders/sass.js
+++ b/config/webpack/loaders/sass.js
@@ -9,7 +9,7 @@ module.exports = {
       { loader: 'css-loader', options: { minimize: env.NODE_ENV === 'production' } },
       { loader: 'postcss-loader', options: { sourceMap: true } },
       'resolve-url-loader',
-      'sass-loader',
+      { loader: 'sass-loader', options: { includePaths: ['app/javascript/styles'] } },
     ],
   }),
 };
diff --git a/config/webpack/shared.js b/config/webpack/shared.js
index 4d865b816..98e864a66 100644
--- a/config/webpack/shared.js
+++ b/config/webpack/shared.js
@@ -44,7 +44,10 @@ module.exports = {
 
   plugins: [
     new webpack.EnvironmentPlugin(JSON.parse(JSON.stringify(env))),
-    new ExtractTextPlugin(env.NODE_ENV === 'production' ? '[name]-[hash].css' : '[name].css'),
+    new ExtractTextPlugin({
+      filename: env.NODE_ENV === 'production' ? '[name]-[hash].css' : '[name].css',
+      allChunks: true,
+    }),
     new ManifestPlugin({
       publicPath: output.publicPath,
       writeToFileEmit: true,